Contents
For some organizations with many distributed remote offices (branches, or retail outlets, such as retail chains or F&B companies), the remote networks are usually connected back to the HQ network via layer 3 IP networks, either through the public Internet, MPLS, or private leased-line, etc. But sometimes it may be desirable to connect remote sites “seamlessly” as if the sites are directly connected via an Ethernet cable and sit in the same layer-2 Ethernet network (eg. emulated Metro-E backbone network).
.
There are a few options to achieve such objectives.
- Some service providers offers Metro-Ethernet service, which can be expensive.
- Another option is to use L2TPv3 tunneling to connect remote sites over Layer3 IP networks (eg. public Internet). This can be a alternative method and very cost-effective. mbox products support such feature (see more details here).
- However, L2TPv3 is a site-to-site tunnel that requires both end points to have static IP addresses, which may not always be feasible. For example, many small remote outlets typically subscribe for cheaper dynamic Internet lines, and they may even connect over mobile backhaul (3G|4G|5G/LTE), or a combination of both for redundancy. In such scenarios, running “Ethernet over SSLVPN” will offer flexibility, using HSA/UA together with CMG across any type of ISP networks.
.
To achieve “Ethernet over SSLVPN“, we will use a few built-in features from mbox CMG and HSA | UA product families:
- SSLVPN, allows remote sites to connect back to HQ using either static or dynamic IP lines (or even from behind a firewall). See more details.
- Multi-WAN, to provide redundancy for ISP links. Especially HSA-500-L2 comes with dual LTE support, and we can make use of Multi-WAN for bonding and auto-failover. See more on Multi-WAN, and learn how to configure Multi-WAN on HSA here.
- Ethernet bridging, to bridge SSLVPN tap tunnels with CMG & HSA/UA LAN interfaces, so the layer2 Ethernet networks are extended across IP SSLVPN tunnels as if they’re connected via an Ethernet cable. See more on Ethernet bridging.
.
.
In this section, we’re going to use CMG and HSA/UA to demonstrate this feature.
To configure a few key points to NOTE:
1. SSLVPN must run on tap mode (layer 2 tunnel).
2. Only one network (or one VLAN) per VPN instance is supported. Each VPN instance/tab bridges with one Ethernet segment.
3. If you need to support multiple VLANs, eg. multiple Ethernet segments across IP, you can run multiple instances of SSLVPN on both CMG and HSA, with each tap (instance of VPN) bridged to its respective VLAN. Alternatively, you can use the L2TPv3 tunnel (one tunnel trunking for multiple VLANs).
4. On CMG, assign tap and eth1 (LAN) in the same bridge group.
5. On HSA/UA, assign tap interface to br-lan (br-eth1) bridge.
6. (optional) Assign VPN tunnel pool to tap interfaces. It’s not necessary to assign IP addresses to tap interfaces, since the tap interfaces are like virtual “Ethernet” cables. But optionally you may want to do that so that you can ping the tap interfaces between HSA/UA, and CMG for connectivity tests only.
7. (optional) Configure Multi-WAN on HSA/UA for link redundancy.
Prerequisite
Provision Gateway device and map to Entity. Refer to Add Host to Target Entities and New Gateway
NOTE
Add Gateway device with default Topology Template > Click the mac address of the Gateway and Click on 
button to save the config to the device.
- User can navigate to ‘ORCHESTRATOR > Configuration > Gateway, click on the mac address below the ‘Gateway‘ column
- Navigate to ‘Interface & DHCP‘ tab and click on ‘VLAN‘ (vlan10@eth1 – 10.10.10.1/24).
- To add ip address, user can click on
button, to add ip address.
The fields of the VLAN Interface List are explained below:
| S/N | Fields | Values |
|---|---|---|
| 01. | VLAN | vlan10 |
| 02. | Main Interface | eth0 |
| 03. | Admin Status | Enable (tick) |
| 04. | IPv4 Address | 10.10.10.1/24 | Join SD-WAN – Enable (tick) |
| 05. | Description | VPN Network |
.
- User can click on the next tab (DHCP Server) to configure DHCP settings for the VLAN.
The fields of the VLAN DHCP Server List are explained below:
| S/N | Fields | Values |
|---|---|---|
| 01. | DHCP Server | Enable (tick) |
| 02. | DHCP Pool Range | Start: 10.10.10.10 End: 10.10.10.254 |
| 03. | DHCP Description | VLAN10_ DHCP |
.
- Configure firewall input rule (UDP)
firewall-input <rule no> permit all udp dport <port no>| ex:firewall-input 200 permit all udp dport 144
- Navigate to ‘SD-WAN > SSL-VPN‘ menu to configure the Gateway VPN Instance
- Click on
button, to configure VPN instance.
The fields of the SSL VPN instance list are explained below:
| S/N | Fields | Values |
|---|---|---|
| 01. | VPN Instance ID * | 1 |
| 02. | Server Public Address / VPN Port * | <Server URL or IP address> VPN Port: 1446 |
| 03. | Tunnel Pool Network/Prefix | 10.1.1.0/24 |
| 04. | VPN Topology * | L3 VPN |
| 05. | Encryption Options | Default Encryption |
| 06. | Other Options | TAP Mode Client-to-Client |
| 07. | Start | Enable (tick) |
- Click on the
button and the 
button. - Click on the button to push the configuration to the Gateway device.
Prerequisite
Provision remote host and map Host’s to Entity. Refer to Add Host to Target Entities and New SD-Branch.
- User can navigate to ‘ORCHESTRATOR > Configuration > SD-Branch, click on the mac address below the ‘Branch‘ column.
NOTE
Add SD-Branch device with default Topology Template > Click the mac address of the Branch and Click on button to save the config in the device.
- Navigate to ‘Interface & DHCP‘ tab and click on ‘VLAN‘ (vlan10@eth1 – 10.11.11.1/24).
- To add ip address, user can click on button, to add ip address.
The fields of the VLAN Interface List are explained below:
| S/N | Fields | Values |
|---|---|---|
| 01. | VLAN | vlan10 |
| 02. | Main Interface | eth1 |
| 03. | Admin Status | Enable (tick) |
| 04. | IPv4 Address | 10.11.11.1/24 | Join SD-WAN – Enable (tick) |
| 05. | Description | VPN Network |
.
- User can click on the next tab (DHCP Server) to configure DHCP settings for the VLAN.
The fields of the VLAN DHCP Server List are explained below:
| S/N | Fields | Values |
|---|---|---|
| 01. | DHCP Server | Enable (tick) |
| 02. | DHCP Pool Range | Start : 11.11.11.11 End : 11.11.11.254 |
| 03. | DHCP Description | VLAN10_ DHCP |
.
Configure VPN instance in Branch.
- Navigate to ‘SD-WAN > SSL-VPN‘ menu.
The fields of the SSL VPN instance list are explained below:
| S/N | Fields | Values |
|---|---|---|
| 01. | Instance ID * | <From the drop-down, select the created Gateway Instance> |
| 02. | Other Options | Select [Tunnel tracking:] option |
| 03. | Enable | Enable (tick) |
- Click on the button and the button at the bottom.
- Click on the button to push the configuration to the Gateway device.